As for cross-chain, put simply, it’s trusting a set of people you’ve never met—except it’s “people” replaced with “nodes” and “contracts.” My understanding is that once you set up trust for a cross-chain transfer, there are really three components: the validators on the source chain, the validators of the relay chain or the bridge, and the target chain’s contract logic. If anything goes wrong in any of those steps—say, when the oracle’s pricing is abnormal and everyone is still just “waiting for confirmation”—then the result is funds getting stuck or getting siphoned off. Anyway, when I run into cross-chain now, my first instinct is to check whether the validator set it uses is diversified enough, and whether the contract has any audit “dark history.” Don’t ask me how I know—people who’ve been burned don’t talk much.